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We describe the experimental test of a quantum key distribution performed with a two-way 
protocol without using entanglement. An individual incoherent eavesdropping is simulated and 
induces a variable amount of noise on the communication channel. This allows a direct verification 
of the agreement between theory and practice. 
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One of the most attractive application of quantum me- 
chanics is the quantum key distribution (QKD), which 
allows for the secret sharing of correlated random data 
between two (or more) users, traditionally called Alice 
and Bob. Since the seminal works by Bennett and Bras- 
sard and Ekert 0, QKD developed into a promis- 
ing field of research for near-future technology ([3j; for a 
review see Q), and both theoretical p| and experimen- 
tal work has been done in order to prove its security 
and feasibility. A feature of QKD is that none of the users 
knows in advance the final form of the generated key. On 
the contrary the secure transmission of a predetermined 
key has been recently investigated thr oug h schemes that 
exploit 0,H or do not exploit [ijj Gj entanglement, 
and that are usually cited as deterministic, with refer- 
ence to Bob's in principle possibility of knowing with 
certainty the information encoded by Alice |T^ . 

In this Letter we present the experimental test of a 
QKD realized with the two-way protocol described in 
Ref. [ll| an d termed LM05. We simulate the noise re- 
lated to a class of attacks by Eve, and by accordingly 
varying it we measure all the quantities relevant to an 
effective transmission of information. 
The Protocol- In LM05 Bob prepares a qubit in one of 
the four states |0), |1) (the Pauli Z eigenstates), |+), |— ) 
(Pauli X eigenstates), and sends it to his counterpart 
Alice. With probability c Alice uses the qubit to test the 
channel noise (control mode, CM) or, with probability 
1 — c, she uses it to encode a bit of information (encoding 
mode, EM). The CM consists in a projective measure- 
ment of the qubit along a basis randomly chosen between 
Z and X , followed by the preparation of a new qubit in 
the same state as the outcome of the measurement. The 
EM is the modification of the qubit state according to 
one of the following transformations: the identity oper- 
ation I, which leaves the qubit unchanged and encodes 
the logical '0', or iY = ZX, which flips the qubit and 
encodes the logical T\ Alice can now send the qubit 
back to Bob who measures it in the same basis he pre- 
pared it; in case of an EM run this feature allows Bob to 
deterministically infer Alice's operation. After the whole 
transmission Alice declares the CM and the EM runs. 
Comparing the data collected during the CM the users 
estimate the Quantum Bit Error Rates (QBERs) on the 



forward and backward channels; we call these two 'par- 
tial' QBERs respectively q\ and qi- Comparing a part of 
the data collected during the EM the users estimate also 
a third, 'total', QBER Qab- This quantity is not nec- 
essary for the security of the protocol but proves useful 
for estimating the mutual information between Alice and 
Bob. As usual for a QKD the exchange of the raw key is 
then followed by the procedures of error correction |l3j ] 
and privacy amplification |14| . 

The communication is realized exploiting linear polar- 
ization states of near infrared photons. In FigQ is re- 
ported a sketch of the experimental setup. The pho- 
tons are generated by a type II down-conversion process: 
a UV pump beam from a diode laser (A = 406. 5nm, 
power 25mW) impinges on a 1.5mm thick BBO crys- 
tal cut at an angle of 43°. We select the intersection 
of the ordinary propagating light cone and the extraor- 
dinary one at an angular aperture of the two beams 
around ~ 3.5° [l^ . The wide spectral width of the pump 
beam (AA = 0.9nm) affects the entanglement of the two- 
photon, as in the case of pulsed pump ^(|; to obtain a 
totally symmetrical spectrum we used an interferomet- 
ric technique 0|. The two output modes of PBSi are 
launched into single mode fibers yjj at 810nm through a 
pair of interference filters centered at 810nm and a band- 
width of 40nm, which are used to reduce the background 
light. The fibers terminate onto the sensible area of two 
APD modules with quantum efficiency ~ 70% at 810nm. 
The coincidence rate is around lOOOcps for single count 
rate of around 12000cps. The polarization state after 
the PBSi can be expressed as \ip) = (jOO) - \ll))/y/2. 
Two Glenn-Laser polarizer (GL) were inserted after the 
PBSi to verify the quality of the polarization entangle- 
ment of the state. The state purity has been tested by a 
tomographic reconstruction |l9| . We measured an entan- 
glement of formation of 0.989 ± 0.005 23 an d a violation 
of the CHSH Bell inequality of over 98 standard devi- 
ations 21]. Bob prepares the qubits measuring one of 
the output mode of the interferometer with a A/2 wave- 
plate (WPi), a GL and detector T. The detection of this 
photon projects the other one on the desired polarization 
state and serves also as trigger for the whole communica- 
tion system. We note that entanglement is not necessary 
for the protocol itself. This specific preparation proce- 
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FIG. 1: Sketch of the experimental setup. Inset: the distri- 
bution of QBER for different sets of preparation by Bob and 
operation by Alice. Bob's preparation is reported on the over- 
lay, Alice's encoding is represented by the area colour: lighter 
gray for I (logical '0'), darker gray for iY (logical '!'). 



dure was chosen because it can be easily extended for a 
true random passive choice of the initial state using only 
linear optics components. The prepared photon is then 
launched into a 5m long single mode fiber at 810nm to- 
wards Alice. 

Alice passively switches between CM and EM via a 
50/50 BS. Control mode: when Alice's measuring ba- 
sis is the same as Bob's the coincidence clicks between 
the two detectors Ao and Ai and the trigger detec- 
tor T permit to estimate q± through the usual formula: 
qi = C err / (Cq + Ci), where Cq,i is the rate of coincidence 
and C err = Co,i depending on Bob's state preparation. 
To complete the control mode, Alice injects an atten- 
uated light pulse of definite polarization with a wave- 
length of 810nm in the BS. This pulse is generated by 
a pulsed diode laser (not shown in figure) with a rep- 
etition rate of 80MHz, pulse width 88ps FWHM, at- 
tenuated to an average number of photons per pulse of 
[i = (1.20 ± 0.05) x 10~ 3 . Encoding Mode: for encoding 
the message is necessary to realize the I and the i Y Pauli 
operators. A couple of A/2 waveplates (WP2,3) allows to 
span all the equator of the Bloch sphere (an eventual 
phase has no importance for the rest of the protocol) . As 
last step, the photon travels back to Bob through a dif- 
ferent fiber, 5m long too. The photons sent by Alice are 
eventually polarization-analyzed at Bob's side by PBS3 
and a A/2 waveplate (WP4) set so that the photons are 
measured in the same basis as they were prepared. The 
photons are collected after the PBS3 into two multimode 
fibers and then detected by two APD modules, Bo and 
Bi. During CM runs a measure of (72 is obtained in the 
same way as qi with the difference that the photons come 
from the pulsed laser that also supplies a trigger signal. 
Coincidence counts between B or Bi and the trigger T 
can be associated to logical values '0' or '1' corresponding 
to Alice encoding in the EM runs. In our experimental 
tests we used all the coincidence counts to estimate Qab- 



In the inset of Figgis reported a typical communication 
test. It consists in a direct measurement of Qab for 
different state preparations performed by Bob and dif- 
ferent encodings by Alice. All the eight configurations 
of interest are reported. The best value we obtained for 
Qab is (4.05 ± 0.22) x 10~ 2 . Before every test the fibers 
were aligned using two polarization control pads, one for 
each fiber. The pads are set so that any polarization 
input state exits almost unchanged. The usual fidelity 
for the polarization state after the alignment is ~ 96%. 
The fibers proved to remain stable for quite long periods 
(~ 4h), enough for several runs after the alignment [22l| . 
Eavesdropping- The CM of LM05 comprises the same 
security test of BB84 pj, repeated twice. This gives to 
the two-way LM05 at least the same security level of the 
one-way BB84. Nevertheless there are indications that 
the security threshold of two-way schemes can overcome 
that of one-way schemes. In particular LM05 results se- 
cure against individual incoherent attack (IIA) regard- 
less of the noise introduced on the channel by an eaves- 
dropper (Eve) [Tlfj: on the contrary BB84 results secure 
against individual attacks only if the noise threshold is 
lower than ~15% (0, || Sec.VI.E). In the optimal IIA 
Eve prepares two sets of ancillae e, r/ and makes them 
interact with the qubit: the e's on the forward path and 
the 77's on the backward one, after Alice's encoding stage. 
By proper measure of her two sets of ancillae, Eve can 
gain information about the key. There are two mutually 
exclusive interactions that minimize Eve's noise on the 
channel while maximizing her gain [TT| : 
Z-attack: 
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where we have introduced the states |e; 
\sl_) = [\el) ± kf>]/2 and \e*J = [|ej) ± |e x )]/2. The 
Z and X indicate the basis whose eigenstates remain un- 
changed under Eve's action. The states |£o,i) an d 
are normalized and non orthogonal: (sq i\ef ) = cos<^>f 
and (4,_|<£,+) = coscjyf, with cf>^ x € [0,tt/2]. Analo- 
gous expressions hold for backward propagation with rj's 
ancillae in the place of e's. If Eve chooses the Z-attack, 
Eqs.QJ, she introduces no noise on the channel when Bob 
prepares the eigenstates of the Z-basis but creates dis- 
turbance in the conjugate basis X; the same argument 
applies for the X-attack, Eqs.(|5J). The absence of a public 
basis revelation in the LM05 protocol prevents Eve from 
always choosing the best attack strategy between the Z 
and the X-attack. In the frame of the IIA attack an ex- 
plicit functional relation among the three QBERs, qi, q2 
and Qab can be found. Let us consider the expression 
of the forward QBER for the Z and X-state preparation, 
qi z and q\ x respectively, as functions of the angles <fif and 
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(/>J chosen by Eve on the forward path: 

q lz = (1 - cos cf>f)/2 gix = (1 - cos <%)/2 (3) 

Through these relations Alice and Bob can guess Eve's 
angles <p~, <j>% from the measured quantities qi z ,qix, re- 
spectively. Analogous results (with angles </>^ and </>^) 
hold for the partial QBERs q2 Z and q2 X of the backward 
channel. The expression of the third QBER Qab can 
be derived as the average probability that Alice and Bob 
find an error on the total two-way channel in the EM: 

Qabi = Qu + In ~ 2gii q 2 i i = 0, z) (4) 

This relation is suitable for direct verification since the 
QBERs on the left side and those on the right side 
are measured through independent processes, i.e. respec- 
tively during EM and CM. 

To simulate the presence of an eavesdropper we must 
control the noise on the channels to generate the same ef- 
fect caused by Eve's action described in Eqs.Q) and J2J. 
Consider the following unitary transformation: 

U^t =cos<f% I + ism<j% Z, (5) 

where </>J is the same angle defined for the Eve's Z-attack. 
Following the action of U ^ , 2 on the input states of the 
A-basis, we find that they are flipped with probabil- 
ity sin 2 (0*/2) = (1 — cos0|) /2, equal to the expression 
of qf x in Eq.|j3J). Therefore the unitary transformation 
determines on the forward channel the same effect 
as Eve's attack. An analogous result is true for the back- 
ward path. To evaluate the total QBER Qab, we must 
consider the transformations on the A-states for the for- 
ward and backward channel, U / 2 and t/^z i 2 , and both 
Alice's encoding operations, I and iY . In this way we 
find the two expression: Q\ Bx (I) = sin 2 (0f/2 + <^/2) 
and Q\ Bx (iY) = sin 2 (^/2 - <f%/2). This quantities 
depend on Alice's transformation, but if we take the 
average between them we find the expression Qabx = 
(1 — cos^f cos0^)/2, exactly equal to Eq.(0} after ex- 
pressing the partial QBERs through Eqs. 

The simulated eavesdropping described by Eq.JSJ is 
realized via the two polarization controlling pads on 
the fibers connecting Alice and Bob. The Z-attack is 
achieved aligning the pads so that the Z-states remain al- 
most undisturbed during the propagation. The X-attack 
is obtained in a similar fashion. The presence of un- 
desired contributions due to Y , X operators during the 
simulated Z-attack are taken into account through a pa- 
rameter A, which quantifies the distance from a perfect 
realization of the unitary transformation of Eq.ljSJ). Once 
the two fibers are aligned, we measured the three QBERs 
qi, qi and Qab- A second parameter £ has been intro- 
duced to account for the background noise in the detec- 
tion. In Fig[21we plotted Qab vs Q S AB , i.e. the averages 
of the quantities respectively present on the left and on 
the right side of Eq.(0} over all the state preparations. 




FIG. 2: Plot of Qab vs Q S AB , as defined in the text. The 
experimental points along with their statistical errors are re- 
ported as diamonds. The dashed-line represents the relation 
given in Eq.JlJ. The solid- line is drawn by setting the param- 
eters, introduced in the text, A = 0.015 and £ = 0.03. Results 
for a uniform random distribution of these parameters in the 
ranges [0,0.03] and [0,0.06], respectively, are reported as a 
contour plot for N t = 5 x 10 5 simulated trials. The contour 
plot represents the frequency of the trials in the bins, equally 
spaced with area 0.005 x 0.005 normalized to the maximum. 



The dashed-line represents the linear relation given by 
Eq.Q. The slightly sloped band is the result of a nu- 
merical simulation with values for the parameters A and 
£ reported in caption of Fig. J2J. 

In order to prove the security of our setup we must 
compare the information shared by Alice and Bob with 
the one possessed by Eve. It is known [24| that a secret 
key can be safely distilled with unidirectional classical 
communication if the condition Iab > niin[7AE, Ibe] is 
accomplished. The average Alice-Bob mutual informa- 
tion is given by: 

Tab = {Iabz + Iabx) /2 (6) 

where Iabz = 1 — h {Qabi) with i = (x, z), and h(x) = 
x log 2 (a;) + (1 — x) log 2 (l — x) is the binary entropy. To 
evaluate Iae we need an estimate of Q defined as the 
error rate between Eve's guesses on Alice's encoding and 
Alice's real encoding. For Eve's Z-attack, Eq.QJ, Q\ E 
reads: 

Qae = 2 ~ 2 V qixq2x (1 - qix) (1 - q2x) ■ (7) 

A similar result holds for Q\ E - We note that these two 
quantities are independent of initial basis preparation, 
and depend only on non-orthogonality of Eve's ancillae. 
The average Alice-Eve mutual information is then 

Iae = {I\ E + % E )/2, (8) 

where I A ' E = 1 — h(Q AE ). An expression for the mutual 
QBER between Bob and Eve, Qbe, can be derived in 
terms of Qab and Qae using the relation Qbe — Qab + 
Qae — 2Qab ■ Qae ■ The average mutual information 
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FIG. 3: Mutual information as function of the QBER Qab • 
The experimental points are reported with their statistical 
errors as crossed-rectangles (/as), white-crossed-rectangles 
(Iae) and gray-crossed-rectangles (Ibe). The solid lines are 
the mutual information with A = 0.015 and £ = 0.03. Results 
of Nt =5x10 simulated trials with the same parameters used 
for Fig|5| are reported. The asymmetric imperfection of the 
two channels cause the gray area below the lines Iae, Ibe- 

between Bob and Eve is then expressed as: 

where = 1 - MQs'iL)' witn i = i x > z )- 

In Fig|31are plotted the curves of mutual information / 
according to Eqs.JHJ), JHJ and as function of the quan- 



tity Qab' already defined. We report in the same figure 
experimental, numerical and theoretical values. The solid 
lines represent our best fit of the experimental data. It 
is worthy of note the almost perfect intersection of these 
lines for Iab, Iae and the theoretical (dashed) line at 
Q" AB — 19%, corresponding to the ~ 23% of detection 
probability in Ref. Furthermore the curve for Ibe 

is always below Iab , implying the security of the scheme 
against IIA regardless of the noise on the channel. 

In conclusion we reported on the experimental test of 
the two-way deterministic protocol for quantum commu- 
nication LM05. We modulated the noise on the channel 
in such a way as to simulate the disturbance introduced 
by Eve's IIA. By means of independent measurements 
of the various involved QBERs we proved the soundness 
of Eq.(0} and rated the quality of our setup. With a 
subsequent measure we estimated the mutual informa- 
tion between Alice, Bob and Eve. Although we did not 
perform a direct, contextual, transmission of a string of 
bits we believe that the good agreement between experi- 
mental data and theoretical predictions presented in this 
work witnesses its potential feasibility. 

We thank S. Mancini, D. Vitali and S. Pirandola for 
fruitful discussions. This work has been supported by the 
Ministero della Istruzione, dell' Universita e della Ricerca 
(FIRB-RBAU01L5AZ and PRIN-2005024254), and the 
European Commission through the Integrated Project 
'Qubit Applications' (QAP), Contract No 015848, funded 
by the 1ST directorate. 



[1] C. H. Bennett and G. Brassard, in Proc. IEEE Int. Con]. 
Comp. Syst. Sign. Proc, Bangalore, India, 1984, pp. 175- 
179. 

[2] A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991). 

[3] C. H. Bennett, Phys. Rev. Lett. 68, 3121 (1992); B. Hut- 

tner et ai, Phys. Rev. A 51, 1863 (1995); D. Bruss, Phys. 

Rev. Lett. 81, 3018 (1998); K. Inoue et ai, Phys. Rev. 

Lett. 89, 037902 (2002). 
[4] N. Gisin, et ai, Rev. of Mod. Phys. 74, 145 (2002). 
[5] D. Mayers, J. ACM 48, 351 (2001); H.-K. Lo and H. 

F. Chau, Science 283, 2050 (1999); P. W. Shor and J. 

Preskill, Phys. Rev. Lett. 85, 441 (2000). 
[6] C. Marand and P. D. Townsend, Opt. Lett. 20, 1695 

(1995); A. Muller et al, Europhys. Lett. 33, 335 (1996); 

R. J. Hughes et al, J. Mod. Opt. 47, 533 (2000); A. 

Poppe et al, Opt. Expr. 12, 3865 (2004); C. Gobby et 

ai, Appl. Phys. Lett. 84, 3762 (2004). 
[7] G. L. Long and X. S. Liu, Phys. Rev. A 65, 032302 

(2002). 

[8] A. Beige, et al, Acta Phys. Pol. A 101, 357 (2002); I. P. 

Degiovanni, et al, Phys. Rev. A 69, 032310 (2004); Q.- 

Y. Cai and B.-W. Li, Phys. Rev. A 69, 054301 (2004); T. 

Gao et al, J. Phys. A: Math. Gen., 38 5761-5770 (2005). 
[9] K. Bostrom and T. Felbinger, Phys. Rev. Lett. 89, 

187902 (2002). 

[10] Q.-Y. Cai and B.-W. Li, Chin.Phys. Lett. 21, 601 (2004); 
F.-G. Deng and G. L. Long, Phys. Rev. A 69, 052319 



(2004); ibid. 70, 012311 (2004); M. Lucamarini, and G. 
Di Giuseppe, Int. J. Quant. Inf. 3, 189 (2005). 
[11] M. Lucamarini and S. Mancini, Phys. Rev. Lett. 94, 
140501 (2005). 

[12] With 'in principle' we essentially mean 'on a noiseless 

and lossless channel'. 
[13] G. Brassard and L. Salvail, Lect. Notes Comp. Sci. 765, 

410 (1994); W.T. Buttler et al, Phys. Rev. A 67, 52303 

(2003). 

[14] C.H. Bennett et al., IEEE Trans. Inf. Theory 41, 1915 
(1995). 

[15] M. H. Rubin, Phys. Rev. A 54, 5349 (1996). 

[16] W. P. Grice and I. A. Walmsley, Phys. Rev. A 56, 1627 
(1997); G. Di Giuseppe, et al, Phys. Rev. A 56, R21 
(1997); T. E. Keller and M. H. Rubin, Phys. Rev. A 
56, 1534 (1997). 

[17] Y.-H. Kim and W. P. Grice, Phys. Rev. A 68,(2003). 

[18] C. Kurtsiefer, et al, Phys. Rev. A 64, 023802 (2001); 
F. A. Bovino, et al, Opt. Comm. 227, 343 (2003). 

[19] D. F. V. James, et ai, Phys. Rev. A 64, 052312 (2001). 

[20] W. K. Wootters, Phys. Rev. Lett. 80, 2245 (1998). 

[21] G. Weihs, et ai, Phys. Rev. Lett. 81, 5039 (1998). 

[22] A. Poppe, et al, Opt. Express 12,3865 (2004). 

[23] C. A. Fuchs et al, Phys. Rev. A 56, 1163 (1997). 

[24] I. Csiszar and J. Korner, IEEE Transactions on Informa- 
tion Theory IT-24, 339 (1978). 



